@sonordev/site-kit 6.0.1 → 6.1.1

package/dist/{chunk-4VCR6TXK.js.map → chunk-OB7K6EFK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/SitemapSync.tsx"],"names":["sonorFetch","locToPath","isMalformedSitemapPath","resolveAnalyticsTarget","inferPageType","useRef","useEffect"],"mappings":";;;;;;;AAwDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMA,2BAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAOC,2BAAU,GAAG,CAAA;AAG1B,MAAA,IAAIC,uCAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,YAAA,CACb,OAAA,EACA,MAAA,EACA,MAAA,EACA,IAAA,EACA,OACA,IAAA,GAAoC,UAAA,EACpC,IAAA,GAA6B,EAAC,EACmC;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,SAASC,uCAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,SAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,CAAA,EAAE;AAC7D,IAAA,MAAM,WAAW,MAAMH,2BAAA,CAAW,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MACpF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAUI,8BAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,OACA,EAAE,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAExC,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC3F,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAeC,aAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAcA,aAA8C,IAAI,CAAA;AAEtE,EAAAC,eAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,KAAA,EAAM;AAC3F,MAAA,MAAM,MAAA,GAASH,wCAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAE1E,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,aAAA,EAAe,IAAI,CAAA;AAC3F,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAACA,uCAAA,CAAuB,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,cAAA,EAAgB,KAAA,EAAO,CAAA,EAAG;AAE9G,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,MAAM,UAAA,EAAY,UAAA,EAAY,YAAA,EAAc,cAAc,CAAC,CAAA;AAEhG,EAAA,OAAO,IAAA;AACT","file":"chunk-4VCR6TXK.js","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from './shared/reporting-gate'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps extends AnalyticsGateOptions {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive',\n  gate: AnalyticsGateOptions = {},\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const target = resolveAnalyticsTarget({ ...gate, apiUrl, apiKey })\n    if (!target) return { success: false, created: 0, updated: 0 }\n    const response = await sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey: target.apiKey, retries: 2 })\n\n    if (!response?.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response?.status, response?.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }\n      const target = resolveAnalyticsTarget(gate)\n      if (!target) return\n      const { apiUrl, apiKey } = target\n      const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode, gate)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode, propApiUrl, propApiKey, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}
+{"version":3,"sources":["../src/SitemapSync.tsx"],"names":["sonorFetch","locToPath","isMalformedSitemapPath","resolveAnalyticsTarget","inferPageType","useRef","useEffect"],"mappings":";;;;;;;AAwDA,IAAM,cAAA,GAAiB,uBAAA;AACvB,IAAM,aAAA,GAAgB,kBAAA;AAEtB,SAAS,iBAAiB,eAAA,EAAkC;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,CAAS,OAAO,EAAE,CAAA;AAC/C,IAAA,OAAO,OAAA,IAAW,CAAA,IAAK,OAAA,GAAU,eAAA,GAAkB,EAAA,GAAK,GAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,GAAoB;AAC3B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,QAAQ,cAAA,EAAgB,IAAA,CAAK,GAAA,EAAI,CAAE,UAAU,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AASA,SAAS,WAAA,CAAY,YAAoB,OAAA,EAAiC;AACxE,EAAA,MAAM,IAAA,GAAO,QACV,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAA,IAAW,EAAE,IAAI,CAAA,CAAE,UAAA,IAAc,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,YAAY,EAAE,CAAA,CAAE,CAAA,CACjF,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAA,GAAA,CAAS,QAAQ,CAAA,IAAK,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA,GAAK,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAC7D;AAEA,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,aAAa,CAAA,KAAM,IAAA;AAAA,EACjD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,IAAA,EAAoB;AAC3C,EAAA,IAAI;AACF,IAAA,YAAA,CAAa,OAAA,CAAQ,eAAe,IAAI,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,KAAA,EAAyC;AACvF,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMA,2BAAA,CAAW,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,wCAAA,EAA0C,SAAS,MAAM,CAAA;AACjF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,iBAAiB,CAAA;AAE1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,oCAAA,EAAsC,WAAW,WAAW,CAAA;AACpF,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AACvC,IAAA,MAAM,UAA0B,EAAC;AAEjC,IAAA,IAAA,CAAK,QAAQ,CAAA,GAAA,KAAO;AAClB,MAAA,MAAM,MAAM,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,MAAA,IAAI,CAAC,GAAA,EAAK;AAEV,MAAA,MAAM,IAAA,GAAOC,2BAAU,GAAG,CAAA;AAG1B,MAAA,IAAIC,uCAAA,CAAuB,IAAI,CAAA,EAAG;AAChC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,uCAAA,EAA0C,IAAI,CAAA,CAAE,CAAA;AACxE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,SAAS,GAAG,WAAA,IAAe,KAAA,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,aAAA,CAAc,YAAY,GAAG,WAAA,IAAe,KAAA,CAAA;AACnE,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,aAAA,CAAc,UAAU,CAAA,EAAG,WAAA;AACnD,MAAA,MAAM,QAAA,GAAW,WAAA,GAAc,UAAA,CAAW,WAAW,CAAA,GAAI,KAAA,CAAA;AAEzD,MAAA,OAAA,CAAQ,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,UAAU,CAAA;AAAA,IACtD,CAAC,CAAA;AAED,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,qBAAA,EAAwB,OAAA,CAAQ,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IAC3E;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,sCAAA,EAAwC,KAAK,CAAA;AACtE,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,eAAe,YAAA,CACb,OAAA,EACA,MAAA,EACA,MAAA,EACA,IAAA,EACA,OACA,IAAA,GAAoC,UAAA,EACpC,IAAA,GAA6B,EAAC,EACmC;AACjE,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,qCAAqC,CAAA;AAC7D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AACzD,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,SAASC,uCAAA,CAAuB,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,SAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,CAAA,EAAE;AAC7D,IAAA,MAAM,WAAW,MAAMH,2BAAA,CAAW,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,gCAAA,CAAA,EAAoC;AAAA,MACpF,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACzB,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,YAAY,CAAA,CAAE,UAAA;AAAA,UACd,QAAA,EAAUI,8BAAA,CAAc,CAAA,CAAE,IAAI;AAAA,SAChC,CAAE,CAAA;AAAA,QACF,IAAA;AAAA;AAAA;AAAA;AAAA,QAIA,GAAI,IAAA,GAAO,EAAE,IAAA,KAAS;AAAC,OACxB;AAAA,OACA,EAAE,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,GAAG,CAAA;AAExC,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,CAAM,4BAA4B,QAAA,EAAU,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC3F,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,IAClD;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAEnC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAI,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAA,QAAA,CAAU,CAAA;AAAA,IAC1F;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC7B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,KAAA,CAAM,2BAAA,EAA6B,KAAK,CAAA;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,SAAS,CAAA,EAAE;AAAA,EAClD;AACF;AAEO,SAAS,WAAA,CAAY;AAAA,EAC1B,UAAA,GAAa,cAAA;AAAA,EACb,YAAA,GAAe,EAAA;AAAA,EACf,KAAA,GAAQ,KAAA;AAAA,EACR,IAAA,GAAO,UAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,YAAA,GAAe,KAAA;AAAA,EACf,cAAA,GAAiB;AACnB,CAAA,EAAqB;AACnB,EAAA,MAAM,YAAA,GAAeC,aAAO,KAAK,CAAA;AACjC,EAAA,MAAM,WAAA,GAAcA,aAA8C,IAAI,CAAA;AAEtE,EAAAC,eAAA,CAAU,MAAM;AAMd,IAAA,MAAM,aAAA,GAA6C,UAAA;AAInD,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,GAAI,YAAA,GAAe,EAAA;AAE1D,IAAA,MAAM,SAAS,YAAY;AACzB,MAAA,MAAM,IAAA,GAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,KAAA,EAAM;AAC3F,MAAA,MAAM,MAAA,GAASH,wCAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAA;AAC3B,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAe,iBAAA,IAAqB,MAAA,CAAO,SAAS,IAAA,IAAQ,EAAA;AAE1E,MAAA,IAAI,gBAAA,CAAiB,eAAe,CAAA,EAAG;AACrC,QAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,qDAAA,EAAkD,iBAAiB,kBAAkB,CAAA;AAC5G,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,UAAe,GAAA,CAAI,wCAAA,EAA0C,OAAO,CAAA,OAAA,EAAU,IAAI,MAAM,EAAE,CAAA;AAE9F,MAAA,MAAM,OAAA,GAAU,MAAM,YAAA,CAAa,UAAA,EAAY,KAAK,CAAA;AAEpD,MAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,UAAA,EAAY,OAAO,CAAA;AAC5C,QAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAI7B,UAAA,WAAA,EAAY;AACZ,UAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,gFAA2E,CAAA;AAClG,UAAA;AAAA,QACF;AACA,QAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,QAAQ,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,aAAA,EAAe,IAAI,CAAA;AAC3F,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,WAAA,EAAY;AACZ,UAAA,eAAA,CAAgB,IAAI,CAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,CAACA,uCAAA,CAAuB,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,cAAA,EAAgB,KAAA,EAAO,CAAA,EAAG;AAE9G,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,YAAA,CAAa,OAAA,GAAU,IAAA;AACvB,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,WAAA,CAAY,OAAA,GAAU,WAAA,CAAY,MAAA,EAAQ,YAAA,GAAe,KAAK,GAAI,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,IAAI,YAAY,OAAA,EAAS;AACvB,QAAA,aAAA,CAAc,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,MAAM,UAAA,EAAY,UAAA,EAAY,YAAA,EAAc,cAAc,CAAC,CAAA;AAEhG,EAAA,OAAO,IAAA;AACT","file":"chunk-OB7K6EFK.js","sourcesContent":["/**\n * SitemapSync - Automatically sync sitemap.xml to Portal API\n *\n * Client-only component. Lives at package root so the main entry does not\n * pull in seo/ (and server-only code). For use in SiteKitLayout and\n * from @sonordev/site-kit/seo.\n *\n * @example\n * ```tsx\n * import { SitemapSync } from '@sonordev/site-kit'\n * // or\n * import { SitemapSync } from '@sonordev/site-kit/seo'\n * ```\n */\n\n'use client'\n\nimport { useEffect, useRef } from 'react'\nimport { sonorFetch } from './shared/sonorFetch'\nimport { resolveAnalyticsTarget, type AnalyticsGateOptions } from './shared/reporting-gate'\n// Single source of truth for page-type inference + path normalization, shared\n// with createSitemap (build) and the register-sitemap CLI. Pure string logic,\n// safe in the browser.\nimport { inferPageType, locToPath, isMalformedSitemapPath } from './sitemap/shared'\n\ninterface SitemapSyncProps extends AnalyticsGateOptions {\n  /** Custom sitemap URL (defaults to /sitemap.xml) */\n  sitemapUrl?: string\n  /** How often to re-sync in minutes (0 = only on mount, default: 60) */\n  syncInterval?: number\n  /** Enable debug logging */\n  debug?: boolean\n  /**\n   * Sync mode:\n   * - 'additive' (default for runtime): adds/updates pages but never deletes existing ones\n   * - 'full-replace': replaces the entire page set (use only for build-time sync via createSitemap)\n   */\n  mode?: 'additive' | 'full-replace'\n}\n\ninterface SitemapEntry {\n  path: string\n  lastmod?: string\n  changefreq?: string\n  priority?: number\n  pageType?: string\n}\n\n/**\n * Per-browser-session sync throttle. Build-time sync (createSitemap) is the\n * canonical source of truth; runtime SitemapSync is only a safety net — so\n * re-registering the sitemap on every full page load of every visitor is pure\n * waste (fetch + DOMParser on the visitor's main thread, plus a write per\n * pageview against the API). Stamp the last successful sync in sessionStorage\n * and skip while inside the throttle window.\n */\nconst SYNC_STAMP_KEY = '_sk_sitemap_synced_at'\nconst SYNC_HASH_KEY = '_sk_sitemap_hash'\n\nfunction isRecentlySynced(throttleMinutes: number): boolean {\n  try {\n    const stamp = sessionStorage.getItem(SYNC_STAMP_KEY)\n    if (!stamp) return false\n    const elapsed = Date.now() - parseInt(stamp, 10)\n    return elapsed >= 0 && elapsed < throttleMinutes * 60 * 1000\n  } catch {\n    return false // storage unavailable (private mode) — sync as before\n  }\n}\n\nfunction stampSynced(): void {\n  try {\n    sessionStorage.setItem(SYNC_STAMP_KEY, Date.now().toString())\n  } catch {\n    /* storage unavailable — throttle simply won't apply */\n  }\n}\n\n/**\n * Content-hash guard (localStorage, so it survives across sessions): the\n * sitemap of a static site only changes at deploy, so once ONE sync of a given\n * sitemap succeeded from this browser, re-POSTing the identical entry set is\n * pure API load. Hash the parsed entries; skip the POST when unchanged.\n * Keyed by sitemap URL so multiple SitemapSync instances don't collide.\n */\nfunction hashEntries(sitemapUrl: string, entries: SitemapEntry[]): string {\n  const text = entries\n    .map(e => `${e.path}|${e.lastmod ?? ''}|${e.changefreq ?? ''}|${e.priority ?? ''}`)\n    .join('\\n')\n  let hash = 0\n  for (let i = 0; i < text.length; i++) {\n    hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0\n  }\n  return `${sitemapUrl}:${entries.length}:${hash.toString(16)}`\n}\n\nfunction isAlreadySyncedHash(hash: string): boolean {\n  try {\n    return localStorage.getItem(SYNC_HASH_KEY) === hash\n  } catch {\n    return false\n  }\n}\n\nfunction storeSyncedHash(hash: string): void {\n  try {\n    localStorage.setItem(SYNC_HASH_KEY, hash)\n  } catch {\n    /* storage unavailable — guard simply won't apply */\n  }\n}\n\nasync function parseSitemap(sitemapUrl: string, debug: boolean): Promise<SitemapEntry[]> {\n  try {\n    const response = await sonorFetch(sitemapUrl)\n    if (!response.ok) {\n      if (debug) console.warn('[SitemapSync] Failed to fetch sitemap:', response.status)\n      return []\n    }\n\n    const text = await response.text()\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(text, 'application/xml')\n\n    const parseError = doc.querySelector('parsererror')\n    if (parseError) {\n      if (debug) console.warn('[SitemapSync] Sitemap parse error:', parseError.textContent)\n      return []\n    }\n\n    const urls = doc.querySelectorAll('url')\n    const entries: SitemapEntry[] = []\n\n    urls.forEach(url => {\n      const loc = url.querySelector('loc')?.textContent?.trim()\n      if (!loc) return\n\n      const path = locToPath(loc)\n\n      // Reject malformed paths (embedded domains, double protocols, etc.)\n      if (isMalformedSitemapPath(path)) {\n        if (debug) console.warn(`[SitemapSync] Skipping malformed path: ${path}`)\n        return\n      }\n\n      const lastmod = url.querySelector('lastmod')?.textContent || undefined\n      const changefreq = url.querySelector('changefreq')?.textContent || undefined\n      const priorityStr = url.querySelector('priority')?.textContent\n      const priority = priorityStr ? parseFloat(priorityStr) : undefined\n\n      entries.push({ path, lastmod, changefreq, priority })\n    })\n\n    if (debug) {\n      console.log(`[SitemapSync] Parsed ${entries.length} entries from sitemap`)\n    }\n\n    return entries\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Error parsing sitemap:', error)\n    return []\n  }\n}\n\nasync function syncToPortal(\n  entries: SitemapEntry[],\n  apiUrl: string,\n  apiKey: string,\n  site: string,\n  debug: boolean,\n  mode: 'additive' | 'full-replace' = 'additive',\n  gate: AnalyticsGateOptions = {},\n): Promise<{ success: boolean; created: number; updated: number }> {\n  if (!apiKey) {\n    if (debug) console.warn('[SitemapSync] No API key configured')\n    return { success: false, created: 0, updated: 0 }\n  }\n\n  if (entries.length === 0) {\n    if (debug) console.log('[SitemapSync] No entries to sync')\n    return { success: true, created: 0, updated: 0 }\n  }\n\n  try {\n    // Registration is idempotent in both modes (same payload → same final\n    // state), so retrying a timed-out attempt is safe.\n    const target = resolveAnalyticsTarget({ ...gate, apiUrl, apiKey })\n    if (!target) return { success: false, created: 0, updated: 0 }\n    const response = await sonorFetch(`${target.apiUrl}/api/public/seo/register-sitemap`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        entries: entries.map(e => ({\n          path: e.path,\n          priority: e.priority,\n          changefreq: e.changefreq,\n          pageType: inferPageType(e.path),\n        })),\n        mode,\n        // Sub-site host — tagged on every seo_pages row so the dashboard\n        // can scope the page tree to one microsite. Resolved by\n        // SiteKitClientProviders (see __SITE_KIT_SITE__).\n        ...(site ? { site } : {}),\n      }),\n    }, { apiKey: target.apiKey, retries: 2 })\n\n    if (!response?.ok) {\n      if (debug) console.error('[SitemapSync] API error:', response?.status, response?.statusText)\n      return { success: false, created: 0, updated: 0 }\n    }\n\n    const result = await response.json()\n\n    if (debug) {\n      console.log(`[SitemapSync] Synced: ${result.created} created, ${result.updated} updated`)\n    }\n\n    return {\n      success: true,\n      created: result.created || 0,\n      updated: result.updated || 0,\n    }\n  } catch (error) {\n    if (debug) console.error('[SitemapSync] Sync error:', error)\n    return { success: false, created: 0, updated: 0 }\n  }\n}\n\nexport function SitemapSync({\n  sitemapUrl = '/sitemap.xml',\n  syncInterval = 60,\n  debug = false,\n  mode = 'additive',\n  apiUrl: propApiUrl,\n  apiKey: propApiKey,\n  allowInFrame = false,\n  allowLocalhost = false,\n}: SitemapSyncProps) {\n  const hasSyncedRef = useRef(false)\n  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)\n\n  useEffect(() => {\n    // Build-time sync via createSitemap is the canonical source of truth, but\n    // it can fail during ISR revalidation (app/ dir unavailable on serverless).\n    // Runtime SitemapSync in additive mode is a safe fallback — it adds/updates\n    // pages that may be missing without ever deleting existing ones.\n    // Full-replace is never safe at runtime — always force additive.\n    const effectiveMode: 'additive' | 'full-replace' = 'additive'\n\n    // Throttle window: reuse syncInterval when periodic syncing is on,\n    // otherwise default to 60 minutes for the on-mount sync.\n    const throttleMinutes = syncInterval > 0 ? syncInterval : 60\n\n    const doSync = async () => {\n      const gate = { apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug }\n      const target = resolveAnalyticsTarget(gate)\n      if (!target) return\n      const { apiUrl, apiKey } = target\n      const site = (window as any).__SITE_KIT_SITE__ || window.location.host || ''\n\n      if (isRecentlySynced(throttleMinutes)) {\n        if (debug) console.log('[SitemapSync] Skipped — synced within the last', throttleMinutes, 'min this session')\n        return\n      }\n\n      if (debug) console.log('[SitemapSync] Starting sitemap sync...', site ? `(site: ${site})` : '')\n\n      const entries = await parseSitemap(sitemapUrl, debug)\n\n      if (entries.length > 0) {\n        const hash = hashEntries(sitemapUrl, entries)\n        if (isAlreadySyncedHash(hash)) {\n          // This exact sitemap already synced from this browser — the server\n          // state can't be improved by re-POSTing it. Stamp the session so we\n          // don't even re-fetch/parse for the rest of the throttle window.\n          stampSynced()\n          if (debug) console.log('[SitemapSync] Skipped POST — sitemap unchanged since last successful sync')\n          return\n        }\n        const result = await syncToPortal(entries, apiUrl, apiKey, site, debug, effectiveMode, gate)\n        if (result.success) {\n          stampSynced()\n          storeSyncedHash(hash)\n        }\n      }\n    }\n\n    if (!resolveAnalyticsTarget({ apiUrl: propApiUrl, apiKey: propApiKey, allowInFrame, allowLocalhost, debug })) return\n\n    if (!hasSyncedRef.current) {\n      hasSyncedRef.current = true\n      doSync()\n    }\n\n    if (syncInterval > 0) {\n      intervalRef.current = setInterval(doSync, syncInterval * 60 * 1000)\n    }\n\n    return () => {\n      if (intervalRef.current) {\n        clearInterval(intervalRef.current)\n      }\n    }\n  }, [sitemapUrl, syncInterval, debug, mode, propApiUrl, propApiKey, allowInFrame, allowLocalhost])\n\n  return null\n}\n"]}

package/dist/chunk-OBKS3CPP.mjs

@@ -0,0 +1,50 @@
+import { jsx } from 'react/jsx-runtime';
+
+// src/shared/glass.tsx
+var GLASS_STYLE_HREF = "sk-glass";
+var GLASS_CSS = `
+.sk-glass {
+  --sk-glass-t: var(--sk-glass-tint, var(--sk-bg, #ffffff));
+  background: color-mix(in srgb, var(--sk-glass-t) var(--sk-glass-opacity, 72%), transparent);
+  -webkit-backdrop-filter: blur(var(--sk-glass-blur, 20px)) saturate(var(--sk-glass-saturate, 180%));
+  backdrop-filter: blur(var(--sk-glass-blur, 20px)) saturate(var(--sk-glass-saturate, 180%));
+  border: 1px solid color-mix(in srgb, color-mix(in srgb, var(--sk-glass-t), #ffffff 50%) 60%, transparent);
+  box-shadow:
+    inset 0 1px 0 color-mix(in srgb, #ffffff 45%, transparent),
+    inset 0 -1px 0 color-mix(in srgb, #ffffff 10%, transparent),
+    0 10px 30px -8px rgba(0, 0, 0, 0.28),
+    0 2px 6px rgba(0, 0, 0, 0.08);
+}
+.sk-glass--panel {
+  background: color-mix(in srgb, var(--sk-glass-t) var(--sk-glass-panel-opacity, 86%), transparent);
+  -webkit-backdrop-filter: blur(var(--sk-glass-blur, 28px)) saturate(var(--sk-glass-saturate, 180%));
+  backdrop-filter: blur(var(--sk-glass-blur, 28px)) saturate(var(--sk-glass-saturate, 180%));
+}
+.sk-glass--brand {
+  --sk-glass-t: var(--sk-glass-brand, var(--sk-primary, #2563eb));
+  background: color-mix(in srgb, var(--sk-glass-t) var(--sk-glass-brand-opacity, 86%), transparent);
+}
+@supports not ((backdrop-filter: blur(1px)) or (-webkit-backdrop-filter: blur(1px))) {
+  .sk-glass, .sk-glass--panel, .sk-glass--brand { background: var(--sk-glass-t); }
+}
+@media (prefers-reduced-transparency: reduce) {
+  .sk-glass, .sk-glass--panel, .sk-glass--brand {
+    background: var(--sk-glass-t);
+    -webkit-backdrop-filter: none;
+    backdrop-filter: none;
+  }
+}
+@media (prefers-contrast: more) {
+  .sk-glass, .sk-glass--panel, .sk-glass--brand {
+    background: var(--sk-glass-t);
+    border-color: currentColor;
+  }
+}
+`;
+function GlassStyles() {
+  return /* @__PURE__ */ jsx("style", { href: GLASS_STYLE_HREF, precedence: "default", children: GLASS_CSS });
+}
+
+export { GlassStyles };
+//# sourceMappingURL=chunk-OBKS3CPP.mjs.map
+//# sourceMappingURL=chunk-OBKS3CPP.mjs.map

package/dist/chunk-OBKS3CPP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/glass.tsx"],"names":[],"mappings":";;;AA4CO,IAAM,gBAAA,GAAmB,UAAA;AAEzB,IAAM,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA6ClB,SAAS,WAAA,GAAc;AAC5B,EAAA,2BACG,OAAA,EAAA,EAAM,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAW,WACvC,QAAA,EAAA,SAAA,EACH,CAAA;AAEJ","file":"chunk-OBKS3CPP.mjs","sourcesContent":["/**\n * @sonordev/site-kit — Liquid Glass surface recipe\n *\n * Single source of truth for the frosted-glass material the kit's floating\n * chrome is made of: the mobile CTA bar (`./cta-bar`) and Echo's launcher\n * and chat window (`./engage`). Both render <GlassStyles /> and put\n * `sk-glass` on their surface, so the two can never drift into two slightly\n * different glasses the way the fleet's eleven hand-rolled CTA bars did.\n *\n * The material, in order of what it does for the visitor:\n *\n *   1. A tint that is mostly opaque (72% by default). Text on glass has to\n *      stay readable over whatever scrolls behind it, so the tint carries the\n *      contrast and the blur only softens what shows through.\n *   2. backdrop blur + saturation, which is what reads as \"glass\".\n *   3. A rim and a specular top edge, derived from the tint so they work on\n *      light and dark glass alike.\n *\n * Every knob is a custom property, so a site tunes the glass from its own\n * stylesheet without fighting specificity:\n *\n *   --sk-glass-tint            surface colour      (default: --sk-bg, then white)\n *   --sk-glass-opacity         tint strength       (default: 72%; 100% = solid)\n *   --sk-glass-panel-opacity   the same, for panels that carry body text (86%)\n *   --sk-glass-brand           brand-tinted glass  (default: --sk-primary)\n *   --sk-glass-blur            backdrop blur       (default: 20px; panels 28px)\n *   --sk-glass-saturate        backdrop saturation (default: 180%)\n *\n * Modifiers: `sk-glass--panel` (denser, for reading surfaces like the Echo\n * chat window) and `sk-glass--brand` (tinted with the brand colour, for a\n * control that is itself the call to action, like the Echo launcher).\n *\n * Fallbacks are part of the recipe, not left to each component: a browser\n * without backdrop-filter, or a visitor who asked the OS for reduced\n * transparency or more contrast, gets the same surface fully opaque.\n *\n * The classes are single-class selectors on purpose. `:where()` would drop\n * them to zero specificity, and Tailwind's preflight (`button { background-\n * color: transparent }`) would then strip the glass off the Echo launcher.\n */\n\nimport * as React from 'react'\n\n/** `href` React 19 dedupes hoisted <style> tags by. */\nexport const GLASS_STYLE_HREF = 'sk-glass'\n\nexport const GLASS_CSS = `\n.sk-glass {\n  --sk-glass-t: var(--sk-glass-tint, var(--sk-bg, #ffffff));\n  background: color-mix(in srgb, var(--sk-glass-t) var(--sk-glass-opacity, 72%), transparent);\n  -webkit-backdrop-filter: blur(var(--sk-glass-blur, 20px)) saturate(var(--sk-glass-saturate, 180%));\n  backdrop-filter: blur(var(--sk-glass-blur, 20px)) saturate(var(--sk-glass-saturate, 180%));\n  border: 1px solid color-mix(in srgb, color-mix(in srgb, var(--sk-glass-t), #ffffff 50%) 60%, transparent);\n  box-shadow:\n    inset 0 1px 0 color-mix(in srgb, #ffffff 45%, transparent),\n    inset 0 -1px 0 color-mix(in srgb, #ffffff 10%, transparent),\n    0 10px 30px -8px rgba(0, 0, 0, 0.28),\n    0 2px 6px rgba(0, 0, 0, 0.08);\n}\n.sk-glass--panel {\n  background: color-mix(in srgb, var(--sk-glass-t) var(--sk-glass-panel-opacity, 86%), transparent);\n  -webkit-backdrop-filter: blur(var(--sk-glass-blur, 28px)) saturate(var(--sk-glass-saturate, 180%));\n  backdrop-filter: blur(var(--sk-glass-blur, 28px)) saturate(var(--sk-glass-saturate, 180%));\n}\n.sk-glass--brand {\n  --sk-glass-t: var(--sk-glass-brand, var(--sk-primary, #2563eb));\n  background: color-mix(in srgb, var(--sk-glass-t) var(--sk-glass-brand-opacity, 86%), transparent);\n}\n@supports not ((backdrop-filter: blur(1px)) or (-webkit-backdrop-filter: blur(1px))) {\n  .sk-glass, .sk-glass--panel, .sk-glass--brand { background: var(--sk-glass-t); }\n}\n@media (prefers-reduced-transparency: reduce) {\n  .sk-glass, .sk-glass--panel, .sk-glass--brand {\n    background: var(--sk-glass-t);\n    -webkit-backdrop-filter: none;\n    backdrop-filter: none;\n  }\n}\n@media (prefers-contrast: more) {\n  .sk-glass, .sk-glass--panel, .sk-glass--brand {\n    background: var(--sk-glass-t);\n    border-color: currentColor;\n  }\n}\n`\n\n/**\n * The glass stylesheet. Render it next to any `sk-glass` surface; React 19\n * hoists it into <head> and keeps exactly one copy however many components\n * render it, on the server and in the browser.\n */\nexport function GlassStyles() {\n  return (\n    <style href={GLASS_STYLE_HREF} precedence=\"default\">\n      {GLASS_CSS}\n    </style>\n  )\n}\n"]}

package/dist/{chunk-NNQG25M2.mjs → chunk-OP42HO3Z.mjs}

@@ -1,5 +1,5 @@
 import { resolveFetch } from './chunk-BQP6JIE2.mjs';
-import { SITE_KIT_VERSION } from './chunk-7MAHP735.mjs';
+import { SITE_KIT_VERSION } from './chunk-HQWPCX3N.mjs';
 import 'server-only';
 
 var MINT_PATH = "/api/public/site-token";
@@ -124,5 +124,5 @@ async function mintWithRetry(rawKey, apiUrl) {
 }
 
 export { resolveClientCredential };
-//# sourceMappingURL=chunk-NNQG25M2.mjs.map
-//# sourceMappingURL=chunk-NNQG25M2.mjs.map
+//# sourceMappingURL=chunk-OP42HO3Z.mjs.map
+//# sourceMappingURL=chunk-OP42HO3Z.mjs.map

package/dist/{chunk-NNQG25M2.mjs.map → chunk-OP42HO3Z.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-NNQG25M2.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}
+{"version":3,"sources":["../src/server/mint-site-token.ts"],"names":[],"mappings":";;;;AAgDA,IAAM,SAAA,GAAY,wBAAA;AAClB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,iBAAA,GAAoB,MAAA;AAO1B,IAAM,iBAAA,GAAoB,CAAA;AAC1B,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,mBAAA,GAAsB,GAAA;AAM5B,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAO1C,IAAM,QAAA,uBAAe,GAAA,EAA6B;AAElD,IAAM,KAAA,GAAQ,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA;AAOxE,SAAS,YAAA,CAAa,KAAsB,OAAA,EAAyB;AACnE,EAAA,MAAM,MAAA,GAAS,GAAA,EAAK,OAAA,EAAS,GAAA,GAAM,aAAa,CAAA;AAChD,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAC9B,OAAA,GAAU,GAAA,GACV,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAClC,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAA,IAAK,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,mBAAmB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,oBAAA,GAAuB,CAAA,IAAK,SAAS,mBAAmB,CAAA;AAC1E;AAGA,IAAM,iBAAA,GAAoB,CAAC,MAAA,KAAmB,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAM1E,SAAS,kBAAA,GAA8B;AACrC,EAAA,OACE,OAAO,OAAA,KAAY,WAAA,IACnB,OAAA,CAAQ,KAAK,yBAAA,KAA8B,KAAA;AAE/C;AAEA,SAAS,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,GAAA,EAAqB;AACvE,EAAA,IAAI,oBAAmB,EAAG;AACxB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,sCAAsC,MAAM,CAAA,uMAAA;AAAA,KAG9C;AACA,IAAA,KAAA,CAAM,GAAA,CAAI,QAAQ,EAAE,UAAA,EAAY,QAAQ,SAAA,EAAW,GAAA,GAAM,KAAQ,CAAA;AACjE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,0CAA0C,MAAM,CAAA,uRAAA;AAAA,GAIlD;AACF;AAsBO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,sBAAA,EAAwB,OAAO,IAAA;AAChD,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,yBAAA,EAA2B,OAAO,IAAA;AACjD,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,EAAE,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,IAAA;AACzE,EAAA,IAAI,EAAE,QAAA,qBAAa,MAAA,CAAO,GAAA,CAAI,gBAAgB,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,eAAsB,uBAAA,CACpB,QACA,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AAEpB,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,MAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AAC/B,EAAA,IAAI,UAAU,MAAA,CAAO,SAAA,GAAY,KAAK,GAAA,EAAI,SAAU,MAAA,CAAO,UAAA;AAG3D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAC5C,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,OAAO,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAA;AAAA,EACf,CAAA,SAAE;AACA,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACxB;AACF;AAEA,eAAe,aAAA,CAAc,QAAgB,MAAA,EAAiC;AAC5E,EAAA,MAAM,IAAA,GAAA,CAAQ,MAAA,IAAU,sBAAA,EAAwB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,IAAI,UAAA,GAAa,eAAA;AAEjB,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,iBAAA,EAAmB,OAAA,EAAA,EAAW;AAC5D,IAAA,IAAI,GAAA,GAAuB,IAAA;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,SAAA,KAAc,YAAA,EAAa;AAChD,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI;AAAA,QACzC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,WAAA,EAAa,MAAA;AAAA,UACb,mBAAA,EAAqB;AAAA,SACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,GAAI,YAAY,EAAC,GAAK,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAM,EAAE;AAAA,QACpD,MAAA,EACE,OAAO,WAAA,KAAgB,WAAA,IAAe,YAAY,OAAA,GAC9C,WAAA,CAAY,OAAA,CAAQ,eAAe,CAAA,GACnC,KAAA;AAAA,OACP,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,MAAM,GAAA;AAClC,MAAA,UAAA,GAAa,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA;AAClD,MAAA,IAAI,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACnC,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,OAAY,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,MAAA,MAAM,QAAQ,IAAA,EAAM,KAAA;AACpB,MAAA,MAAM,YAAY,OAAO,IAAA,EAAM,SAAA,KAAc,QAAA,GAAW,KAAK,SAAA,GAAY,IAAA;AACzE,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpE,QAAA,KAAA,CAAM,IAAI,MAAA,EAAQ;AAAA,UAChB,UAAA,EAAY,KAAA;AAAA,UACZ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,IAAK,SAAA,GAAY,GAAA,GAAQ,CAAA,EAAG,EAAA,GAAK,GAAM;AAAA,SACrE,CAAA;AACD,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,UAAA,GAAa,+BAAA;AACb,MAAA;AAAA,IACF;AAKA,IAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACtB,MAAA,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ,EAAE,UAAA,EAAY,MAAA,EAAQ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,EAAQ,CAAA;AACxE,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,UAAA,GAAa,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAC/B,IAAA,IAAI,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,OAAA,GAAU,oBAAoB,CAAA,EAAG;AACpE,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACvC,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,oCAAA,EAAuC,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,YAAA,EACrE,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA;AAAA,OAChD;AACA,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA;AAAA,EACF;AAEA,EAAA,OAAO,UAAA,CAAW,UAAA,EAAY,MAAA,EAAQ,IAAA,CAAK,KAAK,CAAA;AAClD","file":"chunk-OP42HO3Z.mjs","sourcesContent":["/**\n * @sonordev/site-kit/server — Client-token minting (server-only)\n *\n * SiteKitLayout holds the raw `SONOR_API_KEY` server-side but must NOT ship it to\n * the browser. This mints a short-lived, project-scoped token (server-to-server,\n * authenticated with the raw key, no browser Origin so it passes domain-binding)\n * and returns THAT for the layout to inject instead.\n *\n * `import 'server-only'` makes importing this into a client bundle a hard build\n * error — the raw key stays on the server.\n *\n * FAILS CLOSED. If minting genuinely fails, this throws and the build fails —\n * it does NOT publish the raw key. A failed deploy is loud and recoverable; a\n * leaked project secret in public HTML is neither. The only paths that still\n * return the raw key are a 404 (an older API that predates the endpoint, an\n * expected state during rollout) and the explicit `SONOR_SITE_TOKEN_FALLBACK=raw`\n * escape hatch, for when shipping beats being blocked.\n *\n * That posture is not academic. Through 3.5.0 a throttled mint (HTTP 429)\n * returned the raw key AND cached it for 60s, so every page rendered in that\n * window shipped the secret: one real build came out with 180 of 272 prerendered\n * pages carrying it. The build \"succeeded\" and nothing downstream noticed.\n * Rate limiting is transient by definition — the fix is to wait and retry, not\n * to downgrade to publishing the key.\n *\n * Two things keep the request count low enough that throttling is rare:\n *  - a module-level memo, so a worker mints once and every page reuses the seed;\n *  - an in-flight map, because that memo is only populated AFTER the await. Next\n *    renders pages concurrently, so without coalescing the first N concurrent\n *    renders in a process all miss the cache and all fire a request — a\n *    stampede per worker, multiplied by one worker per core. That is how a\n *    single site exhausted a 60/min budget.\n *\n * SEED FRESHNESS: a static page's seed carries `iat` = build time, and the API\n * refuses to refresh a seed older than SITE_TOKEN_MAX_REFRESH_AGE_SECONDS\n * (sonor-api common/site-auth/site-token.util.ts — currently 400 days, raised\n * from 30 alongside this fix). A site not rebuilt within that window serves a\n * seed the client cannot refresh, and its forms/analytics/engage start failing\n * for new visitors. Keep that limit comfortably longer than the fleet's\n * realistic redeploy gap; marketing sites routinely go many months untouched.\n */\nimport 'server-only'\nimport { SITE_KIT_VERSION } from '../shared/version'\nimport { resolveFetch } from '../shared/fresh-fetch'\n\n// Re-exported for this module's unit tests; the helper lives in shared/fresh-fetch.\nexport { resolveFetch }\n\nconst MINT_PATH = '/api/public/site-token'\nconst MINT_TIMEOUT_MS = 4_000\nconst SITE_TOKEN_PREFIX = 'st1.'\n\n/**\n * Retry budget for transient failures (429 / 5xx / network). Rate limiting is\n * measured per minute, so a few seconds of backoff clears it; the whole ladder\n * costs at most ~20s once per build worker, and only when something is wrong.\n */\nconst MINT_MAX_ATTEMPTS = 4\nconst MINT_BACKOFF_BASE_MS = 500\nconst MINT_BACKOFF_CAP_MS = 8_000\n\ninterface CacheEntry {\n  credential: string\n  expiresAt: number\n}\nconst cache = new Map<string, CacheEntry>()\n\n/**\n * Requests already in flight, keyed by raw key. The `cache` above is only\n * written after the response lands, so concurrent renders would otherwise each\n * start their own mint. See the module header.\n */\nconst inflight = new Map<string, Promise<string>>()\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\n/**\n * Honour `Retry-After` when the server sends it (delta-seconds or HTTP date),\n * otherwise exponential backoff. Capped so a misconfigured server cannot stall\n * a build indefinitely.\n */\nfunction retryDelayMs(res: Response | null, attempt: number): number {\n  const header = res?.headers?.get?.('retry-after')\n  if (header) {\n    const seconds = Number(header)\n    const ms = Number.isFinite(seconds)\n      ? seconds * 1000\n      : Date.parse(header) - Date.now()\n    if (Number.isFinite(ms) && ms > 0) return Math.min(ms, MINT_BACKOFF_CAP_MS)\n  }\n  return Math.min(MINT_BACKOFF_BASE_MS * 2 ** attempt, MINT_BACKOFF_CAP_MS)\n}\n\n/** 429 and 5xx are transient; waiting is the correct response to both. */\nconst isRetryableStatus = (status: number) => status === 429 || status >= 500\n\n/**\n * The escape hatch, for when a broken mint must not block a release. Opt-in and\n * loud: it re-enables publishing the project secret in page HTML.\n */\nfunction rawFallbackAllowed(): boolean {\n  return (\n    typeof process !== 'undefined' &&\n    process.env?.SONOR_SITE_TOKEN_FALLBACK === 'raw'\n  )\n}\n\nfunction failClosed(reason: string, rawKey: string, now: number): string {\n  if (rawFallbackAllowed()) {\n    console.warn(\n      `[SiteKitLayout] Token mint failed (${reason}) and SONOR_SITE_TOKEN_FALLBACK=raw is set; ` +\n        'injecting the RAW API KEY into page HTML. The key is publicly readable wherever ' +\n        'this page is served — unset the escape hatch once the mint is healthy.',\n    )\n    cache.set(rawKey, { credential: rawKey, expiresAt: now + 60_000 })\n    return rawKey\n  }\n  throw new Error(\n    `site-kit: could not mint a site token (${reason}). Refusing to publish the raw ` +\n      'SONOR_API_KEY in page HTML, so this build fails instead. Check that the mint ' +\n      'endpoint is reachable and the key is valid, then rebuild. To ship anyway — ' +\n      'which publishes the project secret in public HTML — set SONOR_SITE_TOKEN_FALLBACK=raw.',\n  )\n}\n\n/*\n * The mint uses Next's saved original fetch (resolveFetch, shared/fresh-fetch.ts,\n * which documents why). A credential is not page data: `cache: 'no-store'` would\n * bail a static route before the request goes out (verified on Next 16.2.9: the\n * mint endpoint received zero requests for a static build, and every page\n * shipped the raw key), and a Data Cache entry would let a fresh deploy re-bake a\n * months-old seed. The module-level memo above is the only cache we want: one\n * mint per build process, and a build-fresh seed on every deploy.\n */\n\n/**\n * Next signals \"this render must go dynamic\" by THROWING (DynamicServerError,\n * static-gen bailout, redirect/notFound digests, React's postpone). Those are\n * the framework's control flow, not a mint failure. Swallowing one makes Next\n * believe the render succeeded statically — which is precisely how the raw key\n * ended up stranded in prerendered HTML with no error anywhere. Let them\n * propagate; only real network/HTTP failures fall back to the raw key.\n *\n * @internal Exported for unit tests; not part of the package's public API.\n */\nexport function isFrameworkSignal(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const e = err as { digest?: unknown; code?: unknown; $$typeof?: unknown }\n  if (e.digest === 'DYNAMIC_SERVER_USAGE') return true\n  if (e.code === 'NEXT_STATIC_GEN_BAILOUT') return true\n  if (typeof e.digest === 'string' && e.digest.startsWith('NEXT_')) return true\n  if (e.$$typeof === Symbol.for('react.postpone')) return true\n  return false\n}\n\nexport async function resolveClientCredential(\n  rawKey: string,\n  apiUrl: string,\n): Promise<string> {\n  if (!rawKey) return ''\n  // Env should hold a raw key; if it already looks like a token, pass it through.\n  if (rawKey.startsWith(SITE_TOKEN_PREFIX)) return rawKey\n\n  const cached = cache.get(rawKey)\n  if (cached && cached.expiresAt > Date.now()) return cached.credential\n\n  // Collapse concurrent renders onto one request rather than a stampede.\n  const pending = inflight.get(rawKey)\n  if (pending) return pending\n\n  const request = mintWithRetry(rawKey, apiUrl)\n  inflight.set(rawKey, request)\n  try {\n    return await request\n  } finally {\n    inflight.delete(rawKey)\n  }\n}\n\nasync function mintWithRetry(rawKey: string, apiUrl: string): Promise<string> {\n  const base = (apiUrl || 'https://api.sonor.io').replace(/\\/+$/, '')\n  let lastReason = 'unknown error'\n\n  for (let attempt = 0; attempt < MINT_MAX_ATTEMPTS; attempt++) {\n    let res: Response | null = null\n    try {\n      const { fn: fetchFn, unpatched } = resolveFetch()\n      res = await fetchFn(`${base}${MINT_PATH}`, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          'x-api-key': rawKey,\n          'x-sitekit-version': SITE_KIT_VERSION,\n        },\n        // Only meaningful on the fallback path, where a future Next stopped\n        // exposing `_nextOriginalFetch` and we're back on the patched fetch.\n        // `revalidate: false` is the one setting that neither bails out of static\n        // generation nor downgrades the route to ISR; a Data Cache entry is the\n        // lesser evil versus shipping the raw key again.\n        ...(unpatched ? {} : ({ next: { revalidate: false } } as RequestInit)),\n        signal:\n          typeof AbortSignal !== 'undefined' && AbortSignal.timeout\n            ? AbortSignal.timeout(MINT_TIMEOUT_MS)\n            : undefined,\n      })\n    } catch (err) {\n      // Never swallow the framework's own control flow — see isFrameworkSignal.\n      if (isFrameworkSignal(err)) throw err\n      lastReason = err instanceof Error ? err.message : 'network error'\n      if (attempt < MINT_MAX_ATTEMPTS - 1) {\n        await sleep(retryDelayMs(null, attempt))\n        continue\n      }\n      break\n    }\n\n    if (res.ok) {\n      const data: any = await res.json().catch(() => null)\n      const token = data?.token\n      const expiresIn = typeof data?.expiresIn === 'number' ? data.expiresIn : 3600\n      if (typeof token === 'string' && token.startsWith(SITE_TOKEN_PREFIX)) {\n        cache.set(rawKey, {\n          credential: token,\n          expiresAt: Date.now() + Math.min((expiresIn * 1000) / 2, 30 * 60_000),\n        })\n        return token\n      }\n      lastReason = 'mint returned no usable token'\n      break\n    }\n\n    // 404 = an API older than the endpoint. Expected during rollout, and the raw\n    // key is exactly what such an API still expects, so this stays a fallback\n    // rather than a build failure.\n    if (res.status === 404) {\n      cache.set(rawKey, { credential: rawKey, expiresAt: Date.now() + 60_000 })\n      return rawKey\n    }\n\n    lastReason = `HTTP ${res.status}`\n    if (isRetryableStatus(res.status) && attempt < MINT_MAX_ATTEMPTS - 1) {\n      const delay = retryDelayMs(res, attempt)\n      console.warn(\n        `[SiteKitLayout] Token mint returned ${res.status}; retrying in ${Math.round(delay)}ms ` +\n          `(attempt ${attempt + 2}/${MINT_MAX_ATTEMPTS}).`,\n      )\n      await sleep(delay)\n      continue\n    }\n    break\n  }\n\n  return failClosed(lastReason, rawKey, Date.now())\n}\n"]}

package/dist/{chunk-UILVPI2R.js → chunk-OTCJRVFJ.js}

@@ -28,7 +28,7 @@ function useFieldControls(fields) {
     }
     if (needsFile && !requested.current.file) {
       requested.current.file = true;
-      import('./FileField-N2P6E2PN.js').then((m) => {
+      import('./FileField-2MMV53BG.js').then((m) => {
         if (!cancelled) setControls((prev) => ({ ...prev, File: m.FileField }));
       }).catch(() => {
         requested.current.file = false;
@@ -137,5 +137,5 @@ exports.stageEstimate = stageEstimate;
 exports.stageFirstName = stageFirstName;
 exports.stageViews = stageViews;
 exports.useFieldControls = useFieldControls;
-//# sourceMappingURL=chunk-UILVPI2R.js.map
-//# sourceMappingURL=chunk-UILVPI2R.js.map
+//# sourceMappingURL=chunk-OTCJRVFJ.js.map
+//# sourceMappingURL=chunk-OTCJRVFJ.js.map

package/dist/{chunk-UILVPI2R.js.map → chunk-OTCJRVFJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/field-controls.ts","../src/forms/experience-plan.ts"],"names":["useMemo","useState","useRef","useEffect","isDisplayOnly","isEmptyValue"],"mappings":";;;;;AAqCA,IAAM,cAA6B,EAAC;AAE7B,SAAS,iBAAiB,MAAA,EAAoD;AACnF,EAAA,MAAM,SAAA,GAAYA,aAAA;AAAA,IAChB,MAAA,CAAO,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,KAAe,MAAA,IAAU,CAAA,CAAE,UAAA,KAAe,UAAU,CAAA;AAAA,IACvF,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,SAAA,GAAYA,aAAA;AAAA,IAChB,MAAA,CAAO,UAAU,EAAC,EAAG,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,KAAe,MAAM,CAAA;AAAA,IACxD,CAAC,MAAM;AAAA,GACT;AAEA,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIC,eAAwB,WAAW,CAAA;AAEnE,EAAA,MAAM,YAAYC,YAAA,CAAO,EAAE,MAAM,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAErD,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM;AACxC,MAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,IAAA;AACzB,MAAA,OAAO,0BAAc,CAAA,CAClB,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,QAAA,IAAI,CAAC,SAAA,EAAW,WAAA,CAAY,CAAC,IAAA,MAAU,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,MACzE,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAGX,QAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,MAC3B,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM;AACxC,MAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,IAAA;AACzB,MAAA,OAAO,yBAAa,CAAA,CACjB,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,QAAA,IAAI,CAAC,SAAA,EAAW,WAAA,CAAY,CAAC,IAAA,MAAU,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,SAAA,EAAU,CAAE,CAAA;AAAA,MACxE,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AACX,QAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,MAC3B,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,SAAS,CAAC,CAAA;AAEzB,EAAA,OAAO,QAAA;AACT;;;ACrDO,SAAS,eAAe,MAAA,EAA4C;AACzE,EAAA,MAAM,KAAA,GAAA,CAAS,MAAA,CAAO,MAAA,IAAU,EAAC,EAAG,MAAA;AAAA,IAClC,CAAC,CAAA,KAAM,CAACC,8BAAA,CAAc,CAAC;AAAA,GACzB;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,IAAiB,CAAC,MAAA,CAAO,OAAO,MAAA,EAAQ;AAClD,IAAA,OAAO,MAAM,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAM,CAAE,CAAA;AAAA,EACzC;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,WAAA,GAAc,EAAE,WAAW,CAAA;AAC9E,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,MAAA,IAAI,KAAA,CAAM,OAAA,KAAY,IAAA,CAAK,EAAA,EAAI;AAC7B,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AACxB,QAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,EAAE,CAAA;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,EAAE,GAAG,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,cAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAA,GAAI,CAAA;AAAA,EACV,OAAO,CAAA,GAAI,CAAA;AAAA,EACX,SAAS,CAAA,GAAI;AACf,CAAA;AAQO,SAAS,WAAW,MAAA,EAAwC;AACjE,EAAA,MAAM,SAAA,GAAY,eAAe,MAAM,CAAA;AACvC,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,IAAI,IAAA,GAAyB,IAAA;AAC7B,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,QAAQ,MAAM;AAClB,IAAA,IAAI,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AACzB,IAAA,IAAA,GAAO,IAAA;AACP,IAAA,SAAA,GAAY,CAAA;AAAA,EACd,CAAA;AAEA,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,CAAA,CAAE,KAAA,CAAM,KAAK,CAAA,IAAK,CAAA;AAClD,IAAA,MAAM,iBAAiB,IAAA,IAAQ,IAAA,CAAK,IAAA,EAAM,EAAA,KAAO,EAAE,IAAA,EAAM,EAAA;AACzD,IAAA,IAAI,QAAA,IAAY,CAAA,IAAK,cAAA,EAAgB,KAAA,EAAM;AAC3C,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,EAAE,QAAQ,CAAC,CAAA,CAAE,KAAK,CAAA,EAAG,IAAA,EAAM,EAAE,IAAA,EAAK;AACzC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,IAAI,QAAA,IAAY,GAAG,KAAA,EAAM;AACzB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,GAAY,QAAA,GAAW,MAAA,EAAQ,KAAA,EAAM;AACzC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,EAAE,QAAQ,CAAC,CAAA,CAAE,KAAK,CAAA,EAAG,IAAA,EAAM,EAAE,IAAA,EAAK;AACzC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,CAAE,KAAK,CAAA;AACxB,IAAA,SAAA,IAAa,QAAA;AAAA,EACf;AACA,EAAA,KAAA,EAAM;AACN,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,gBAAgB,MAAA,EAAmC;AACjE,EAAA,OAAO,UAAA,CAAW,MAAM,CAAA,CAAE,MAAA;AAC5B;AAEO,SAAS,oBAAoB,MAAA,EAAmC;AACrE,EAAA,OAAO,cAAA,CAAe,MAAM,CAAA,CAAE,MAAA;AAChC;AAMO,SAAS,cAAc,aAAA,EAA+B;AAC3D,EAAA,MAAM,UAAU,aAAA,GAAgB,CAAA;AAChC,EAAA,IAAI,OAAA,GAAU,EAAA,EAAI,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,IAAA,CAAK,IAAA,CAAK,OAAA,GAAU,CAAC,CAAA,GAAI,CAAC,CAAC,CAAA,QAAA,CAAA;AAC1E,EAAA,IAAI,OAAA,IAAW,IAAI,OAAO,gBAAA;AAC1B,EAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,KAAA,CAAM,OAAA,GAAU,EAAE,CAAC,CAAA,QAAA,CAAA;AAC1C;AAGO,SAAS,eAAe,KAAA,EAA+B;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,IAAA;AACtC,EAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,GAAO,KAAA,CAAM,KAAK,EAAE,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,IAAI,OAAO,IAAA;AACxC,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,aAAa,KAAA,EAA+B;AAC1D,EAAA,IAAIC,6BAAA,CAAa,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,MAAM,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,KAAA,GAAQ,IAAA;AACvD,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAGO,IAAM,kBAAA,GAAqB,CAAC,OAAA,EAAS,QAAA,EAAU,QAAQ","file":"chunk-UILVPI2R.js","sourcesContent":["'use client'\n\n/**\n * The field controls that need React hooks, loaded only when a form actually\n * has a field that uses them.\n *\n * FormField deliberately does NOT import these. DatePicker carries 17 hooks\n * and FileField holds upload state; importing them there put both in\n * FormField's chunk, which the build stamps `'use client'` — so a Server\n * Component rendering a single text input shipped 38 KB of date picker to the\n * browser. Injecting them from the client side keeps FormField hook-free and\n * therefore server-renderable, which is the whole basis of StaticForm.\n *\n * Injection alone still put both controls in the forms entry's eager graph,\n * because a module-level constant referencing them is a static import: every\n * form paid for the date picker, and most forms have no date field. They are\n * now fetched on demand, per control, from the field list.\n *\n * The wait costs nothing visually. FormField already renders the native\n * control when a control is absent (static mode does exactly this), so a date\n * field paints as `<input type=\"date\">` and upgrades in place when the chunk\n * lands — the same enhancement path a no-JS visitor never leaves.\n *\n * Every client renderer of <FormField> (FormClient, FormSpotlight, FormStage)\n * calls this hook, so the experiences and the classic form always offer\n * identical controls.\n */\n\nimport { useEffect, useMemo, useRef, useState } from 'react'\nimport type { FormField as FormFieldType } from './types'\n\nexport interface FieldControls {\n  Date?: React.ComponentType<any>\n  File?: React.ComponentType<any>\n}\n\n/** Stable identity for the common case (no date, no file) — no render churn. */\nconst NO_CONTROLS: FieldControls = {}\n\nexport function useFieldControls(fields: FormFieldType[] | undefined): FieldControls {\n  const needsDate = useMemo(\n    () => (fields ?? []).some((f) => f.field_type === 'date' || f.field_type === 'datetime'),\n    [fields],\n  )\n  const needsFile = useMemo(\n    () => (fields ?? []).some((f) => f.field_type === 'file'),\n    [fields],\n  )\n\n  const [controls, setControls] = useState<FieldControls>(NO_CONTROLS)\n  // Guards re-import when a conditional field toggles visibility mid-fill.\n  const requested = useRef({ date: false, file: false })\n\n  useEffect(() => {\n    let cancelled = false\n\n    if (needsDate && !requested.current.date) {\n      requested.current.date = true\n      import('./DatePicker')\n        .then((m) => {\n          if (!cancelled) setControls((prev) => ({ ...prev, Date: m.DatePicker }))\n        })\n        .catch(() => {\n          // Chunk never arrived — the native date input stays, which submits\n          // the same value. A failed fetch must not cost the lead.\n          requested.current.date = false\n        })\n    }\n\n    if (needsFile && !requested.current.file) {\n      requested.current.file = true\n      import('./FileField')\n        .then((m) => {\n          if (!cancelled) setControls((prev) => ({ ...prev, File: m.FileField }))\n        })\n        .catch(() => {\n          requested.current.file = false\n        })\n    }\n\n    return () => {\n      cancelled = true\n    }\n  }, [needsDate, needsFile])\n\n  return controls\n}\n","/**\n * Shared planning helpers for the alternate form experiences (stage,\n * spotlight). Pure data — no React, no CSS — so FormClient can import the\n * counts it needs for tracking WITHOUT pulling an experience component (and\n * its stylesheet) into every site's forms bundle. The components themselves\n * are lazy-loaded; this module is the only part that ships eagerly.\n */\n\nimport type {\n  FormField as FormFieldType,\n  FormStep,\n  ManagedFormConfig,\n} from './types'\n// Display-only types are never staged; what counts as empty is shared with\n// validation. Both live in field-rules.ts.\nimport { isDisplayOnly, isEmptyValue } from './field-rules'\n\nexport interface StageQuestion {\n  field: FormFieldType\n  /** The step (chapter) this question belongs to, when the form is multi-step. */\n  step?: FormStep\n}\n\nexport interface StageView {\n  fields: FormFieldType[]\n  step?: FormStep\n}\n\n/**\n * Flatten a form into its ordered question list. Steps become chapters:\n * multi-step forms iterate steps in step_number order (fields are already\n * sorted by sort_order via normalizeFormConfig); stepless fields trail.\n */\nexport function stageQuestions(config: ManagedFormConfig): StageQuestion[] {\n  const input = (config.fields || []).filter(\n    (f) => !isDisplayOnly(f),\n  )\n  if (!config.is_multi_step || !config.steps?.length) {\n    return input.map((field) => ({ field }))\n  }\n  const ordered = [...config.steps].sort((a, b) => a.step_number - b.step_number)\n  const out: StageQuestion[] = []\n  const claimed = new Set<string>()\n  for (const step of ordered) {\n    for (const field of input) {\n      if (field.step_id === step.id) {\n        out.push({ field, step })\n        claimed.add(field.id)\n      }\n    }\n  }\n  for (const field of input) {\n    if (!claimed.has(field.id)) out.push({ field })\n  }\n  return out\n}\n\nconst WIDTH_FRACTION: Record<string, number> = {\n  full: 1,\n  half: 1 / 2,\n  third: 1 / 3,\n  quarter: 1 / 4,\n}\n\n/**\n * Group questions into beats using the classic grid's own row math:\n * consecutive sub-full-width fields fill a row (2 halves, 3 thirds...) and\n * that row is one beat; a full-width field closes any open row and stands\n * alone; a chapter change always starts a fresh beat.\n */\nexport function stageViews(config: ManagedFormConfig): StageView[] {\n  const questions = stageQuestions(config)\n  const views: StageView[] = []\n  let open: StageView | null = null\n  let openWidth = 0\n\n  const close = () => {\n    if (open) views.push(open)\n    open = null\n    openWidth = 0\n  }\n\n  for (const q of questions) {\n    const fraction = WIDTH_FRACTION[q.field.width] ?? 1\n    const chapterChanged = open && open.step?.id !== q.step?.id\n    if (fraction >= 1 || chapterChanged) close()\n    if (!open) {\n      open = { fields: [q.field], step: q.step }\n      openWidth = fraction\n      if (fraction >= 1) close()\n      continue\n    }\n    if (openWidth + fraction > 1.0001) close()\n    if (!open) {\n      open = { fields: [q.field], step: q.step }\n      openWidth = fraction\n      continue\n    }\n    open.fields.push(q.field)\n    openWidth += fraction\n  }\n  close()\n  return views\n}\n\nexport function countStageViews(config: ManagedFormConfig): number {\n  return stageViews(config).length\n}\n\nexport function countStageQuestions(config: ManagedFormConfig): number {\n  return stageQuestions(config).length\n}\n\n/**\n * Honest, friendly time estimate: \"about 40 seconds\".\n * ~8s per question, rounded to something a human would actually say.\n */\nexport function stageEstimate(questionCount: number): string {\n  const seconds = questionCount * 8\n  if (seconds < 50) return `about ${Math.max(15, Math.ceil(seconds / 5) * 5)} seconds`\n  if (seconds <= 90) return 'about a minute'\n  return `about ${Math.round(seconds / 60)} minutes`\n}\n\n/** First name for the greeting — conservative: short, single token, else null. */\nexport function stageFirstName(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const token = value.trim().split(/\\s+/)[0]\n  if (!token || token.length > 24) return null\n  return token\n}\n\nexport function formatAnswer(value: unknown): string | null {\n  if (isEmptyValue(value)) return null\n  if (Array.isArray(value)) return value.map(String).join(', ')\n  if (typeof value === 'boolean') return value ? 'Yes' : 'No'\n  return String(value)\n}\n\n/** Single-select types where picking an answer advances after a lock-in beat. */\nexport const AUTO_ADVANCE_TYPES = ['radio', 'select', 'rating']\n"]}
+{"version":3,"sources":["../src/forms/field-controls.ts","../src/forms/experience-plan.ts"],"names":["useMemo","useState","useRef","useEffect","isDisplayOnly","isEmptyValue"],"mappings":";;;;;AAqCA,IAAM,cAA6B,EAAC;AAE7B,SAAS,iBAAiB,MAAA,EAAoD;AACnF,EAAA,MAAM,SAAA,GAAYA,aAAA;AAAA,IAChB,MAAA,CAAO,MAAA,IAAU,EAAC,EAAG,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,KAAe,MAAA,IAAU,CAAA,CAAE,UAAA,KAAe,UAAU,CAAA;AAAA,IACvF,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,SAAA,GAAYA,aAAA;AAAA,IAChB,MAAA,CAAO,UAAU,EAAC,EAAG,KAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,KAAe,MAAM,CAAA;AAAA,IACxD,CAAC,MAAM;AAAA,GACT;AAEA,EAAA,MAAM,CAAC,QAAA,EAAU,WAAW,CAAA,GAAIC,eAAwB,WAAW,CAAA;AAEnE,EAAA,MAAM,YAAYC,YAAA,CAAO,EAAE,MAAM,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAErD,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM;AACxC,MAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,IAAA;AACzB,MAAA,OAAO,0BAAc,CAAA,CAClB,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,QAAA,IAAI,CAAC,SAAA,EAAW,WAAA,CAAY,CAAC,IAAA,MAAU,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,UAAA,EAAW,CAAE,CAAA;AAAA,MACzE,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AAGX,QAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,MAC3B,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,OAAA,CAAQ,IAAA,EAAM;AACxC,MAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,IAAA;AACzB,MAAA,OAAO,yBAAa,CAAA,CACjB,IAAA,CAAK,CAAC,CAAA,KAAM;AACX,QAAA,IAAI,CAAC,SAAA,EAAW,WAAA,CAAY,CAAC,IAAA,MAAU,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,CAAA,CAAE,SAAA,EAAU,CAAE,CAAA;AAAA,MACxE,CAAC,CAAA,CACA,KAAA,CAAM,MAAM;AACX,QAAA,SAAA,CAAU,QAAQ,IAAA,GAAO,KAAA;AAAA,MAC3B,CAAC,CAAA;AAAA,IACL;AAEA,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,SAAS,CAAC,CAAA;AAEzB,EAAA,OAAO,QAAA;AACT;;;ACrDO,SAAS,eAAe,MAAA,EAA4C;AACzE,EAAA,MAAM,KAAA,GAAA,CAAS,MAAA,CAAO,MAAA,IAAU,EAAC,EAAG,MAAA;AAAA,IAClC,CAAC,CAAA,KAAM,CAACC,8BAAA,CAAc,CAAC;AAAA,GACzB;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,IAAiB,CAAC,MAAA,CAAO,OAAO,MAAA,EAAQ;AAClD,IAAA,OAAO,MAAM,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAM,CAAE,CAAA;AAAA,EACzC;AACA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,MAAA,CAAO,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,WAAA,GAAc,EAAE,WAAW,CAAA;AAC9E,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,MAAA,IAAI,KAAA,CAAM,OAAA,KAAY,IAAA,CAAK,EAAA,EAAI;AAC7B,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AACxB,QAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,EAAE,CAAA;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,EAAE,GAAG,GAAA,CAAI,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,cAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,CAAA;AAAA,EACN,MAAM,CAAA,GAAI,CAAA;AAAA,EACV,OAAO,CAAA,GAAI,CAAA;AAAA,EACX,SAAS,CAAA,GAAI;AACf,CAAA;AAQO,SAAS,WAAW,MAAA,EAAwC;AACjE,EAAA,MAAM,SAAA,GAAY,eAAe,MAAM,CAAA;AACvC,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,IAAI,IAAA,GAAyB,IAAA;AAC7B,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,QAAQ,MAAM;AAClB,IAAA,IAAI,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AACzB,IAAA,IAAA,GAAO,IAAA;AACP,IAAA,SAAA,GAAY,CAAA;AAAA,EACd,CAAA;AAEA,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,CAAA,CAAE,KAAA,CAAM,KAAK,CAAA,IAAK,CAAA;AAClD,IAAA,MAAM,iBAAiB,IAAA,IAAQ,IAAA,CAAK,IAAA,EAAM,EAAA,KAAO,EAAE,IAAA,EAAM,EAAA;AACzD,IAAA,IAAI,QAAA,IAAY,CAAA,IAAK,cAAA,EAAgB,KAAA,EAAM;AAC3C,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,EAAE,QAAQ,CAAC,CAAA,CAAE,KAAK,CAAA,EAAG,IAAA,EAAM,EAAE,IAAA,EAAK;AACzC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA,IAAI,QAAA,IAAY,GAAG,KAAA,EAAM;AACzB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,GAAY,QAAA,GAAW,MAAA,EAAQ,KAAA,EAAM;AACzC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,EAAE,QAAQ,CAAC,CAAA,CAAE,KAAK,CAAA,EAAG,IAAA,EAAM,EAAE,IAAA,EAAK;AACzC,MAAA,SAAA,GAAY,QAAA;AACZ,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAA,CAAE,KAAK,CAAA;AACxB,IAAA,SAAA,IAAa,QAAA;AAAA,EACf;AACA,EAAA,KAAA,EAAM;AACN,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,gBAAgB,MAAA,EAAmC;AACjE,EAAA,OAAO,UAAA,CAAW,MAAM,CAAA,CAAE,MAAA;AAC5B;AAEO,SAAS,oBAAoB,MAAA,EAAmC;AACrE,EAAA,OAAO,cAAA,CAAe,MAAM,CAAA,CAAE,MAAA;AAChC;AAMO,SAAS,cAAc,aAAA,EAA+B;AAC3D,EAAA,MAAM,UAAU,aAAA,GAAgB,CAAA;AAChC,EAAA,IAAI,OAAA,GAAU,EAAA,EAAI,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,IAAA,CAAK,IAAA,CAAK,OAAA,GAAU,CAAC,CAAA,GAAI,CAAC,CAAC,CAAA,QAAA,CAAA;AAC1E,EAAA,IAAI,OAAA,IAAW,IAAI,OAAO,gBAAA;AAC1B,EAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,KAAA,CAAM,OAAA,GAAU,EAAE,CAAC,CAAA,QAAA,CAAA;AAC1C;AAGO,SAAS,eAAe,KAAA,EAA+B;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,IAAA;AACtC,EAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,GAAO,KAAA,CAAM,KAAK,EAAE,CAAC,CAAA;AACzC,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,IAAI,OAAO,IAAA;AACxC,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,aAAa,KAAA,EAA+B;AAC1D,EAAA,IAAIC,6BAAA,CAAa,KAAK,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,MAAM,GAAA,CAAI,MAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,KAAA,GAAQ,IAAA;AACvD,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAGO,IAAM,kBAAA,GAAqB,CAAC,OAAA,EAAS,QAAA,EAAU,QAAQ","file":"chunk-OTCJRVFJ.js","sourcesContent":["'use client'\n\n/**\n * The field controls that need React hooks, loaded only when a form actually\n * has a field that uses them.\n *\n * FormField deliberately does NOT import these. DatePicker carries 17 hooks\n * and FileField holds upload state; importing them there put both in\n * FormField's chunk, which the build stamps `'use client'` — so a Server\n * Component rendering a single text input shipped 38 KB of date picker to the\n * browser. Injecting them from the client side keeps FormField hook-free and\n * therefore server-renderable, which is the whole basis of StaticForm.\n *\n * Injection alone still put both controls in the forms entry's eager graph,\n * because a module-level constant referencing them is a static import: every\n * form paid for the date picker, and most forms have no date field. They are\n * now fetched on demand, per control, from the field list.\n *\n * The wait costs nothing visually. FormField already renders the native\n * control when a control is absent (static mode does exactly this), so a date\n * field paints as `<input type=\"date\">` and upgrades in place when the chunk\n * lands — the same enhancement path a no-JS visitor never leaves.\n *\n * Every client renderer of <FormField> (FormClient, FormSpotlight, FormStage)\n * calls this hook, so the experiences and the classic form always offer\n * identical controls.\n */\n\nimport { useEffect, useMemo, useRef, useState } from 'react'\nimport type { FormField as FormFieldType } from './types'\n\nexport interface FieldControls {\n  Date?: React.ComponentType<any>\n  File?: React.ComponentType<any>\n}\n\n/** Stable identity for the common case (no date, no file) — no render churn. */\nconst NO_CONTROLS: FieldControls = {}\n\nexport function useFieldControls(fields: FormFieldType[] | undefined): FieldControls {\n  const needsDate = useMemo(\n    () => (fields ?? []).some((f) => f.field_type === 'date' || f.field_type === 'datetime'),\n    [fields],\n  )\n  const needsFile = useMemo(\n    () => (fields ?? []).some((f) => f.field_type === 'file'),\n    [fields],\n  )\n\n  const [controls, setControls] = useState<FieldControls>(NO_CONTROLS)\n  // Guards re-import when a conditional field toggles visibility mid-fill.\n  const requested = useRef({ date: false, file: false })\n\n  useEffect(() => {\n    let cancelled = false\n\n    if (needsDate && !requested.current.date) {\n      requested.current.date = true\n      import('./DatePicker')\n        .then((m) => {\n          if (!cancelled) setControls((prev) => ({ ...prev, Date: m.DatePicker }))\n        })\n        .catch(() => {\n          // Chunk never arrived — the native date input stays, which submits\n          // the same value. A failed fetch must not cost the lead.\n          requested.current.date = false\n        })\n    }\n\n    if (needsFile && !requested.current.file) {\n      requested.current.file = true\n      import('./FileField')\n        .then((m) => {\n          if (!cancelled) setControls((prev) => ({ ...prev, File: m.FileField }))\n        })\n        .catch(() => {\n          requested.current.file = false\n        })\n    }\n\n    return () => {\n      cancelled = true\n    }\n  }, [needsDate, needsFile])\n\n  return controls\n}\n","/**\n * Shared planning helpers for the alternate form experiences (stage,\n * spotlight). Pure data — no React, no CSS — so FormClient can import the\n * counts it needs for tracking WITHOUT pulling an experience component (and\n * its stylesheet) into every site's forms bundle. The components themselves\n * are lazy-loaded; this module is the only part that ships eagerly.\n */\n\nimport type {\n  FormField as FormFieldType,\n  FormStep,\n  ManagedFormConfig,\n} from './types'\n// Display-only types are never staged; what counts as empty is shared with\n// validation. Both live in field-rules.ts.\nimport { isDisplayOnly, isEmptyValue } from './field-rules'\n\nexport interface StageQuestion {\n  field: FormFieldType\n  /** The step (chapter) this question belongs to, when the form is multi-step. */\n  step?: FormStep\n}\n\nexport interface StageView {\n  fields: FormFieldType[]\n  step?: FormStep\n}\n\n/**\n * Flatten a form into its ordered question list. Steps become chapters:\n * multi-step forms iterate steps in step_number order (fields are already\n * sorted by sort_order via normalizeFormConfig); stepless fields trail.\n */\nexport function stageQuestions(config: ManagedFormConfig): StageQuestion[] {\n  const input = (config.fields || []).filter(\n    (f) => !isDisplayOnly(f),\n  )\n  if (!config.is_multi_step || !config.steps?.length) {\n    return input.map((field) => ({ field }))\n  }\n  const ordered = [...config.steps].sort((a, b) => a.step_number - b.step_number)\n  const out: StageQuestion[] = []\n  const claimed = new Set<string>()\n  for (const step of ordered) {\n    for (const field of input) {\n      if (field.step_id === step.id) {\n        out.push({ field, step })\n        claimed.add(field.id)\n      }\n    }\n  }\n  for (const field of input) {\n    if (!claimed.has(field.id)) out.push({ field })\n  }\n  return out\n}\n\nconst WIDTH_FRACTION: Record<string, number> = {\n  full: 1,\n  half: 1 / 2,\n  third: 1 / 3,\n  quarter: 1 / 4,\n}\n\n/**\n * Group questions into beats using the classic grid's own row math:\n * consecutive sub-full-width fields fill a row (2 halves, 3 thirds...) and\n * that row is one beat; a full-width field closes any open row and stands\n * alone; a chapter change always starts a fresh beat.\n */\nexport function stageViews(config: ManagedFormConfig): StageView[] {\n  const questions = stageQuestions(config)\n  const views: StageView[] = []\n  let open: StageView | null = null\n  let openWidth = 0\n\n  const close = () => {\n    if (open) views.push(open)\n    open = null\n    openWidth = 0\n  }\n\n  for (const q of questions) {\n    const fraction = WIDTH_FRACTION[q.field.width] ?? 1\n    const chapterChanged = open && open.step?.id !== q.step?.id\n    if (fraction >= 1 || chapterChanged) close()\n    if (!open) {\n      open = { fields: [q.field], step: q.step }\n      openWidth = fraction\n      if (fraction >= 1) close()\n      continue\n    }\n    if (openWidth + fraction > 1.0001) close()\n    if (!open) {\n      open = { fields: [q.field], step: q.step }\n      openWidth = fraction\n      continue\n    }\n    open.fields.push(q.field)\n    openWidth += fraction\n  }\n  close()\n  return views\n}\n\nexport function countStageViews(config: ManagedFormConfig): number {\n  return stageViews(config).length\n}\n\nexport function countStageQuestions(config: ManagedFormConfig): number {\n  return stageQuestions(config).length\n}\n\n/**\n * Honest, friendly time estimate: \"about 40 seconds\".\n * ~8s per question, rounded to something a human would actually say.\n */\nexport function stageEstimate(questionCount: number): string {\n  const seconds = questionCount * 8\n  if (seconds < 50) return `about ${Math.max(15, Math.ceil(seconds / 5) * 5)} seconds`\n  if (seconds <= 90) return 'about a minute'\n  return `about ${Math.round(seconds / 60)} minutes`\n}\n\n/** First name for the greeting — conservative: short, single token, else null. */\nexport function stageFirstName(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const token = value.trim().split(/\\s+/)[0]\n  if (!token || token.length > 24) return null\n  return token\n}\n\nexport function formatAnswer(value: unknown): string | null {\n  if (isEmptyValue(value)) return null\n  if (Array.isArray(value)) return value.map(String).join(', ')\n  if (typeof value === 'boolean') return value ? 'Yes' : 'No'\n  return String(value)\n}\n\n/** Single-select types where picking an answer advances after a lock-in beat. */\nexport const AUTO_ADVANCE_TYPES = ['radio', 'select', 'rating']\n"]}

package/dist/{chunk-ZYJYBE5G.js → chunk-OUZQL5PV.js}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk4NBJDP6Y_js = require('./chunk-4NBJDP6Y.js');
+var chunkEF7QCYLF_js = require('./chunk-EF7QCYLF.js');
 var jsxRuntime = require('react/jsx-runtime');
 
 function HoneypotField({ name, value, onChange }) {
@@ -46,7 +46,7 @@ function nativeEligible(config) {
 }
 function nativeFormProps(config) {
   if (!nativeEligible(config)) return {};
-  const { apiUrl } = chunk4NBJDP6Y_js.getApiConfig();
+  const { apiUrl } = chunkEF7QCYLF_js.getApiConfig();
   return { action: `${apiUrl}/api/public/forms/submit-native`, method: "post" };
 }
 function NativeFallbackFields({ config, returnTo }) {
@@ -60,5 +60,5 @@ function NativeFallbackFields({ config, returnTo }) {
 exports.HoneypotField = HoneypotField;
 exports.NativeFallbackFields = NativeFallbackFields;
 exports.nativeFormProps = nativeFormProps;
-//# sourceMappingURL=chunk-ZYJYBE5G.js.map
-//# sourceMappingURL=chunk-ZYJYBE5G.js.map
+//# sourceMappingURL=chunk-OUZQL5PV.js.map
+//# sourceMappingURL=chunk-OUZQL5PV.js.map

package/dist/{chunk-ZYJYBE5G.js.map → chunk-OUZQL5PV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx","getApiConfig","jsxs","Fragment"],"mappings":";;;;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIC,6BAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAH,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-ZYJYBE5G.js","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}
+{"version":3,"sources":["../src/forms/HoneypotField.tsx","../src/forms/native-fallback.tsx"],"names":["jsx","getApiConfig","jsxs","Fragment"],"mappings":";;;;;AAqCO,SAAS,aAAA,CAAc,EAAE,IAAA,EAAM,KAAA,EAAO,UAAS,EAAuB;AAC3E,EAAA,MAAM,WAAA,GAAc,OAAO,QAAA,KAAa,UAAA;AACxC,EAAA,uBACEA,cAAA;AAAA,IAAC,OAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,MAAA;AAAA,MACL,IAAA;AAAA,MACA,QAAA,EAAU,EAAA;AAAA,MACV,YAAA,EAAa,cAAA;AAAA,MACb,aAAA,EAAY,MAAA;AAAA,MACZ,KAAA,EAAK,IAAA;AAAA,MACL,kBAAA,EAAiB,EAAA;AAAA,MAGjB,gBAAA,EAAe,EAAA;AAAA,MACf,eAAA,EAAc,MAAA;AAAA,MACd,gBAAA,EAAe,OAAA;AAAA,MACf,eAAA,EAAc,EAAA;AAAA,MACd,KAAA,EAAO;AAAA,QACL,QAAA,EAAU,UAAA;AAAA,QACV,IAAA,EAAM,KAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,CAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,OAAA,EAAS,CAAA;AAAA,QACT,UAAA,EAAY,QAAA;AAAA,QACZ,aAAA,EAAe;AAAA,OACjB;AAAA,MACC,GAAI,WAAA,GACD;AAAA,QACE,OAAO,KAAA,IAAS,EAAA;AAAA,QAChB,QAAA,EAAU,CAAC,CAAA,KAA2C;AACpD,UAAA,QAAA,CAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACxB,UAAA,IAAI,CAAA,CAAE,OAAO,KAAA,EAAO;AAElB,YAAA,OAAA,CAAQ,KAAK,4BAA4B,CAAA;AAAA,UAC3C;AAAA,QACF;AAAA,OACF,GACA,EAAE,YAAA,EAAc,EAAA;AAAG;AAAA,GACzB;AAEJ;ACjDA,SAAS,eAAe,MAAA,EAAuD;AAC7E,EAAA,OAAO,CAAC,CAAC,MAAA,EAAQ,YAAA,IAAgB,CAAC,MAAA,CAAO,aAAA;AAC3C;AAGO,SAAS,gBACd,MAAA,EACsC;AACtC,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIC,6BAAA,EAAa;AAChC,EAAA,OAAO,EAAE,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,+BAAA,CAAA,EAAmC,QAAQ,MAAA,EAAO;AAC9E;AAaO,SAAS,oBAAA,CAAqB,EAAE,MAAA,EAAQ,QAAA,EAAS,EAA8B;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,uBACEC,eAAA,CAAAC,mBAAA,EAAA,EACE,QAAA,EAAA;AAAA,oBAAAH,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,aAAY,KAAA,EAAO,MAAA,CAAQ,YAAA,EAAc,QAAA,EAAQ,IAAA,EAAC,CAAA;AAAA,IAC3E,QAAA,mBAAWA,cAAAA,CAAC,OAAA,EAAA,EAAM,IAAA,EAAK,QAAA,EAAS,IAAA,EAAK,YAAA,EAAa,KAAA,EAAO,QAAA,EAAU,QAAA,EAAQ,IAAA,EAAC,CAAA,GAAK;AAAA,GAAA,EACpF,CAAA;AAEJ","file":"chunk-OUZQL5PV.js","sourcesContent":["/**\n * Single source of truth for the honeypot input — rendered by BOTH form\n * experiences (classic and stage) inside their <form>. The customRender path\n * deliberately gets none (documented limitation: custom renders lose the\n * honeypot, which is why alternate experiences must be render branches).\n *\n * Invariants (do not weaken any of these):\n * - `inert` blocks focus/interaction at the browser level, surviving hostile\n *   site CSS that could defeat the inline styles.\n * - data-sk-honeypot gives site CSS a stable opt-OUT hook.\n * - Controlled input: bots filling via JS still fire React onChange, so the\n *   value reaches submitForm's data payload.\n * - Name comes from config (`honeypot_field || DEFAULT_HONEYPOT_FIELD` from\n *   the shared contract) — resolved by the caller, never forked here.\n * - The trap must be invisible to AUTOFILL as well as to people. A browser or\n *   password manager filling a hidden input flags a real visitor as a bot, and\n *   because the value is stripped server-side the mistake is undiagnosable\n *   after the fact. `autocomplete=\"off\"` does not achieve this — it is the one\n *   value Chrome deliberately ignores for contact/address autofill — so the\n *   trap declares `new-password` (never offered saved contact data) plus the\n *   documented per-manager opt-outs.\n */\n\nimport React from 'react'\n\nexport interface HoneypotFieldProps {\n  name: string\n  value?: string\n  /**\n   * Omit for STATIC mode — an uncontrolled trap a Server Component can render.\n   * The trap's whole job is server-side (the value is read off the submission\n   * and stripped), so it needs no client state to work; the controlled form is\n   * only so the hydrated JSON path can read it back out of React state.\n   */\n  onChange?: (value: string) => void\n}\n\nexport function HoneypotField({ name, value, onChange }: HoneypotFieldProps) {\n  const interactive = typeof onChange === 'function'\n  return (\n    <input\n      type=\"text\"\n      name={name}\n      tabIndex={-1}\n      autoComplete=\"new-password\"\n      aria-hidden=\"true\"\n      inert\n      data-sk-honeypot=\"\"\n      // Password-manager opt-outs: 1Password, LastPass, Dashlane, Bitwarden.\n      // Each ignores its own attribute; none respects autocomplete alone.\n      data-1p-ignore=\"\"\n      data-lpignore=\"true\"\n      data-form-type=\"other\"\n      data-bwignore=\"\"\n      style={{\n        position: 'absolute',\n        left: -9999,\n        width: 1,\n        height: 1,\n        overflow: 'hidden',\n        opacity: 0,\n        visibility: 'hidden',\n        pointerEvents: 'none',\n      }}\n      {...(interactive\n        ? {\n            value: value ?? '',\n            onChange: (e: React.ChangeEvent<HTMLInputElement>) => {\n              onChange!(e.target.value)\n              if (e.target.value) {\n                // Bot detected\n                console.warn('[Forms] Honeypot triggered')\n              }\n            },\n          }\n        : { defaultValue: '' })}\n    />\n  )\n}\n","'use client'\n\n/**\n * No-JS native submission fallback — the floor under every managed form.\n *\n * The classic form is the SSR/no-JS surface (experiences are post-hydration\n * chunks), so it alone carries a real `action`/`method` pointing at\n * sonor-api's POST /api/public/forms/submit-native. With JS running, the\n * form's onSubmit preventDefault()s and the JSON path wins; without JS the\n * browser performs an ordinary form-encoded POST and the lead still lands.\n *\n * Auth rides in the hidden `_sk_token` field: a signed, single-purpose\n * credential minted by the api-key-authenticated forms/config endpoint\n * (`native_token` in the response). No token in the config (older API, or no\n * signing secret) means no fallback — the form keeps its historical behavior\n * rather than pointing at an endpoint that will reject it.\n *\n * Multi-step forms are excluded: step navigation is JS, and a native POST of\n * step-1 fields alone fails whole-form validation server-side. Single-step\n * forms are the overwhelming lead-capture case.\n *\n * Single source of truth for the gating — the form attrs and the hidden\n * fields must always agree, so both read the same predicate.\n */\n\nimport React from 'react'\nimport type { ManagedFormConfig } from './types'\nimport { getApiConfig } from './submitForm'\n\nfunction nativeEligible(config: ManagedFormConfig | null | undefined): boolean {\n  return !!config?.native_token && !config.is_multi_step\n}\n\n/** `action`/`method` for the classic <form> — empty when ineligible. */\nexport function nativeFormProps(\n  config: ManagedFormConfig | null | undefined,\n): { action?: string; method?: 'post' } {\n  if (!nativeEligible(config)) return {}\n  const { apiUrl } = getApiConfig()\n  return { action: `${apiUrl}/api/public/forms/submit-native`, method: 'post' }\n}\n\nexport interface NativeFallbackFieldsProps {\n  config: ManagedFormConfig | null | undefined\n  /**\n   * Absolute URL the native 303 should land on (usually the page hosting the\n   * form). Optional — without it the server falls back to the Referer origin,\n   * which loses the path but still returns the visitor to the right site.\n   */\n  returnTo?: string\n}\n\n/** Hidden control fields the native endpoint reads (`_sk_*` namespace). */\nexport function NativeFallbackFields({ config, returnTo }: NativeFallbackFieldsProps) {\n  if (!nativeEligible(config)) return null\n  return (\n    <>\n      <input type=\"hidden\" name=\"_sk_token\" value={config!.native_token} readOnly />\n      {returnTo ? <input type=\"hidden\" name=\"_sk_return\" value={returnTo} readOnly /> : null}\n    </>\n  )\n}\n"]}

package/dist/chunk-QWUDHOUE.js

@@ -0,0 +1,8 @@
+'use strict';
+
+// src/shared/version.ts
+var SITE_KIT_VERSION = "6.1.1";
+
+exports.SITE_KIT_VERSION = SITE_KIT_VERSION;
+//# sourceMappingURL=chunk-QWUDHOUE.js.map
+//# sourceMappingURL=chunk-QWUDHOUE.js.map

package/dist/{chunk-F3EAAAZ3.js.map → chunk-QWUDHOUE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;AASO,IAAM,gBAAA,GAAmB","file":"chunk-F3EAAAZ3.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.0.1'\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;AASO,IAAM,gBAAA,GAAmB","file":"chunk-QWUDHOUE.js","sourcesContent":["/**\n * @sonordev/site-kit shared - Package version constant\n *\n * Single source of truth for the version the kit reports at runtime (the\n * x-sitekit-version request header set by sonorFetch). Kept as a plain const\n * so client bundles don't need JSON imports; scripts/verify-dts.cjs asserts\n * it matches package.json at publish time, and version.test.ts asserts it in\n * dev, so it can't silently drift.\n */\nexport const SITE_KIT_VERSION = '6.1.1'\n"]}